@effect-app/infra 4.0.0-beta.22 → 4.0.0-beta.221

package/src/api/setupRequest.ts

@@ -1,9 +1,21 @@
-import { Effect, Layer, Tracer } from "effect-app"
+import * as Effect from "effect-app/Effect"
+import * as Layer from "effect-app/Layer"
+import * as Option from "effect-app/Option"
 import { NonEmptyString255 } from "effect-app/Schema"
+import * as Tracer from "effect/Tracer"
+import { SqlClient } from "effect/unstable/sql"
 import { LocaleRef, RequestContext, spanAttributes } from "../RequestContext.js"
 import { ContextMapContainer } from "../Store/ContextMapContainer.js"
 import { storeId } from "../Store/Memory.js"
 
+const withSqlTransaction = <R, E, A>(self: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>
+  Effect.serviceOption(SqlClient.SqlClient).pipe(
+    Effect.flatMap(Option.match({
+      onNone: () => self,
+      onSome: (sql) => sql.withTransaction(self).pipe(Effect.orDie)
+    }))
+  )
+
 export const getRequestContext = Effect
   .all({
     span: Effect.currentSpan.pipe(Effect.orDie),
@@ -12,7 +24,7 @@ export const getRequestContext = Effect
   })
   .pipe(
     Effect.map(({ locale, namespace, span }) =>
-      new RequestContext({
+      RequestContext.make({
         span: Tracer.externalSpan(span),
         locale,
         namespace,
@@ -43,16 +55,25 @@ const withRequestSpan = (name = "request", options?: Tracer.SpanOptions) => <R,
       )
   )
 
+export interface SetupRequestOptions {
+  readonly withTransaction?: boolean
+}
+
 export const setupRequestContextFromCurrent =
-  (name = "request", options?: Tracer.SpanOptions) => <R, E, A>(self: Effect.Effect<A, E, R>) =>
+  (name = "request", options?: Tracer.SpanOptions & SetupRequestOptions) => <R, E, A>(self: Effect.Effect<A, E, R>) =>
     self
       .pipe(
+        options?.withTransaction === true ? withSqlTransaction : (_) => _,
         withRequestSpan(name, options),
-        Effect.provide(ContextMapContainer.layer)
+        Effect.provide(ContextMapContainer.layer, { local: true })
       )
 
 // TODO: consider integrating Effect.withParentSpan
-export function setupRequestContext<R, E, A>(self: Effect.Effect<A, E, R>, requestContext: RequestContext) {
+export function setupRequestContext<R, E, A>(
+  self: Effect.Effect<A, E, R>,
+  requestContext: RequestContext,
+  options?: SetupRequestOptions
+) {
   const layer = Layer.mergeAll(
     ContextMapContainer.layer,
     Layer.succeed(LocaleRef, requestContext.locale),
@@ -60,8 +81,9 @@ export function setupRequestContext<R, E, A>(self: Effect.Effect<A, E, R>, reque
   )
   return self
     .pipe(
+      options?.withTransaction === true ? withSqlTransaction : (_) => _,
       withRequestSpan(requestContext.name),
-      Effect.provide(layer)
+      Effect.provide(layer, { local: true })
     )
 }
 
@@ -69,7 +91,7 @@ export function setupRequestContextWithCustomSpan<R, E, A>(
   self: Effect.Effect<A, E, R>,
   requestContext: RequestContext,
   name: string,
-  options?: Tracer.SpanOptions
+  options?: Tracer.SpanOptions & SetupRequestOptions
 ) {
   const layer = Layer.mergeAll(
     ContextMapContainer.layer,
@@ -78,7 +100,8 @@ export function setupRequestContextWithCustomSpan<R, E, A>(
   )
   return self
     .pipe(
+      options?.withTransaction === true ? withSqlTransaction : (_) => _,
       withRequestSpan(name, options),
-      Effect.provide(layer)
+      Effect.provide(layer, { local: true })
     )
 }

package/src/arbs.ts

@@ -1,13 +1,15 @@
 // Do not import to frontend
 
 import { faker } from "@faker-js/faker"
-import { type S } from "effect-app"
 import { setFaker } from "effect-app/faker"
+import type * as S from "effect-app/Schema"
 import * as FastCheck from "effect/testing/FastCheck"
 import { Random } from "fast-check"
-import * as rand from "pure-rand"
+import { congruential32 } from "pure-rand/generator/congruential32"
 
-const rnd = new Random(rand.congruential32(5))
+const seed = 5
+const rng = congruential32(seed)
+const rnd = new Random(rng)
 
 setFaker(faker)
 

package/src/errorReporter.ts

@@ -1,6 +1,8 @@
 import * as Sentry from "@sentry/node"
-import { Cause, Effect, type LogLevel } from "effect-app"
+import * as Effect from "effect-app/Effect"
 import { dropUndefined, LogLevelToSentry } from "effect-app/utils"
+import * as Cause from "effect/Cause"
+import type * as LogLevel from "effect/LogLevel"
 import { getRC } from "./api/setupRequest.js"
 import { CauseException, tryToJson, tryToReport } from "./errors.js"
 import { InfraLogger } from "./logger.js"
@@ -13,47 +15,41 @@ const tryCauseException = <E>(cause: Cause.Cause<E>, name: string): CauseExcepti
   }
 }
 
-export function reportError(
-  name: string
-) {
-  return (
-    cause: Cause.Cause<unknown>,
-    extras?: Record<string, unknown>,
-    level: LogLevel.Severity = "Error"
-  ) =>
-    Effect
-      .gen(function*() {
-        if (Cause.hasInterruptsOnly(cause)) {
-          yield* InfraLogger.logDebug("Interrupted").pipe(Effect.annotateLogs("extras", JSON.stringify(extras ?? {})))
-          return
-        }
-        const error = tryCauseException(cause, name)
-
-        yield* reportSentry(error, extras, LogLevelToSentry(level))
-        yield* InfraLogger
-          .logWithLevel(level, "Reporting error", cause)
-          .pipe(
-            Effect.annotateLogs(dropUndefined({
-              extras,
-              error: tryToReport(error),
-              cause: tryToJson(cause),
-              __error_name__: name
-            }))
-          )
-          .pipe(
-            Effect.catchCause((cause) => InfraLogger.logWarning("Failed to log error", cause)),
-            Effect.catchCause(() => InfraLogger.logFatal("Failed to log error cause"))
-          )
+export function reportError(name: string) {
+  return Effect.fnUntraced(
+    function*(
+      cause: Cause.Cause<unknown>,
+      extras?: Record<string, unknown>,
+      level: LogLevel.Severity = "Error"
+    ) {
+      if (Cause.hasInterruptsOnly(cause)) {
+        yield* InfraLogger.logDebug("Interrupted").pipe(Effect.annotateLogs("extras", JSON.stringify(extras ?? {})))
+        return
+      }
+      const error = tryCauseException(cause, name)
 
-        return error
-      })
-      .pipe(
-        Effect.tapCause((cause) =>
-          InfraLogger.logError("Failed to report error", cause).pipe(
-            Effect.tapCause(() => InfraLogger.logFatal("Failed to log error cause"))
-          )
+      yield* reportSentry(error, extras, LogLevelToSentry(level))
+      yield* InfraLogger
+        .logWithLevel(level, "Reporting error", cause)
+        .pipe(
+          Effect.annotateLogs(dropUndefined({
+            extras,
+            error: tryToReport(error),
+            cause: tryToJson(cause),
+            __error_name__: name
+          })),
+          Effect.catchCause((cause) => InfraLogger.logWarning("Failed to log error", cause)),
+          Effect.catchCause(() => InfraLogger.logFatal("Failed to log error cause"))
         )
-      )
+
+      return error
+    },
+    (effect) =>
+      Effect.tapCause(effect, (cause) =>
+        InfraLogger.logError("Failed to report error", cause).pipe(
+          Effect.tapCause(() => InfraLogger.logFatal("Failed to log error cause"))
+        ))
+  )
 }
 
 function reportSentry(
@@ -66,45 +62,39 @@ function reportSentry(
     scope.setLevel(level)
     if (context) scope.setContext("context", { ...context })
     if (extras) scope.setContext("extras", extras)
-    scope.setContext("error", { data: tryToReport(error) })
-    scope.setContext("cause", { data: tryToJson(error.originalCause) })
+    const squashed = Cause.squash(error.originalCause)
+    scope.setContext("mainError", tryToJson(squashed))
+    scope.setContext("error", tryToReport(error))
+    scope.setContext("cause", tryToJson(error.originalCause))
     Sentry.captureException(error, scope)
   }))
 }
 
-export function logError<E>(
-  name: string
-) {
-  return (cause: Cause.Cause<E>, extras?: Record<string, unknown>) =>
-    Effect
-      .gen(function*() {
-        if (Cause.hasInterruptsOnly(cause)) {
-          yield* InfraLogger.logDebug("Interrupted").pipe(Effect.annotateLogs(dropUndefined({ extras })))
-          return
-        }
-        yield* InfraLogger
-          .logWarning("Logging error", cause)
-          .pipe(
-            Effect.annotateLogs(dropUndefined({
-              extras,
-              cause: tryToJson(cause),
-              __error_name__: name
-            }))
-          )
-      })
-      .pipe(
-        Effect.tapCause(() => InfraLogger.logFatal("Failed to log error cause"))
-      )
+export function logError<E>(name: string) {
+  return Effect.fnUntraced(
+    function*(cause: Cause.Cause<E>, extras?: Record<string, unknown>) {
+      if (Cause.hasInterruptsOnly(cause)) {
+        yield* InfraLogger.logDebug("Interrupted").pipe(Effect.annotateLogs(dropUndefined({ extras })))
+        return
+      }
+      yield* InfraLogger
+        .logWarning("Logging error", cause)
+        .pipe(Effect.annotateLogs(dropUndefined({
+          extras,
+          cause: tryToJson(cause),
+          __error_name__: name
+        })))
+    },
+    (effect) => Effect.tapCause(effect, () => InfraLogger.logFatal("Failed to log error cause"))
+  )
 }
 
-export function reportMessage(message: string, extras?: Record<string, unknown>) {
-  return Effect.gen(function*() {
-    const context = yield* getRC
-    const scope = new Sentry.Scope()
-    if (context) scope.setContext("context", { ...context })
-    if (extras) scope.setContext("extras", extras)
-    Sentry.captureMessage(message, scope)
+export const reportMessage = Effect.fnUntraced(function*(message: string, extras?: Record<string, unknown>) {
+  const context = yield* getRC
+  const scope = new Sentry.Scope()
+  if (context) scope.setContext("context", { ...context })
+  if (extras) scope.setContext("extras", extras)
+  Sentry.captureMessage(message, scope)
 
-    console.warn(message, extras)
-  })
-}
+  console.warn(message, extras)
+})

package/src/fileUtil.ts

@@ -1,5 +1,5 @@
 import crypto from "crypto"
-import { Effect } from "effect-app"
+import * as Effect from "effect-app/Effect"
 import type { Abortable } from "events"
 import type { Mode, ObjectEncodingOptions, OpenMode } from "fs"
 import fs from "fs/promises"

package/src/logger/jsonLogger.ts

@@ -1,4 +1,6 @@
-import { Array, Cause, Logger } from "effect-app"
+import * as Array from "effect-app/Array"
+import * as Cause from "effect/Cause"
+import * as Logger from "effect/Logger"
 import { CurrentLogAnnotations, CurrentLogSpans } from "effect/References"
 import { spanAttributes } from "../RequestContext.js"
 import { getRequestContextFromFiber } from "./shared.js"

package/src/logger/logFmtLogger.ts

@@ -1,4 +1,4 @@
-import { Logger } from "effect-app"
+import * as Logger from "effect/Logger"
 import { spanAttributes } from "../RequestContext.js"
 import { getRequestContextFromFiber } from "./shared.js"
 

package/src/logger/shared.ts

@@ -1,5 +1,6 @@
-import { type Fiber, Option } from "effect-app"
+import * as Option from "effect-app/Option"
 import { NonEmptyString255 } from "effect-app/Schema"
+import type * as Fiber from "effect/Fiber"
 import { LocaleRef, RequestContext } from "../RequestContext.js"
 import { storeId } from "../Store/Memory.js"
 
@@ -7,7 +8,7 @@ export function getRequestContextFromFiber(fiber: Fiber.Fiber<unknown, unknown>)
   const span = Option.fromNullishOr(fiber.currentSpan)
   const locale = fiber.getRef(LocaleRef)
   const namespace = fiber.getRef(storeId)
-  return new RequestContext({
+  return RequestContext.make({
     span: Option.map(span, (s) => ({ spanId: s.spanId, traceId: s.traceId, sampled: s.sampled })).pipe(
       Option.getOrElse(() => ({ spanId: "bogus", sampled: true, traceId: "bogus" }))
     ),

package/src/otel.ts

@@ -0,0 +1,152 @@
+/**
+ * OpenTelemetry semantic-convention helpers for span attributes.
+ *
+ * Aligns repository / queue / cache adapters with stable OTel semconv keys so
+ * downstream collectors and dashboards work without per-adapter mappings.
+ *
+ * - Database: https://opentelemetry.io/docs/specs/semconv/database/
+ * - Messaging: https://opentelemetry.io/docs/specs/semconv/messaging/
+ * - Cosmos DB:  https://opentelemetry.io/docs/specs/semconv/database/cosmosdb/
+ */
+
+import * as Effect from "effect-app/Effect"
+
+export type DbSystem =
+  | "postgresql"
+  | "sqlite"
+  | "cosmosdb"
+  | "mongodb"
+  | "redis"
+  | "other_sql"
+  | "memory"
+  | "disk"
+
+export interface DbSpanOptions {
+  /** OTel `db.operation.name` (e.g. `find`, `all`, `filter`, `set`). */
+  readonly operation: string
+  readonly system: DbSystem
+  /** Logical collection / table / container name. */
+  readonly collection: string
+  /** Tenant / namespace / database name. */
+  readonly namespace?: string | undefined
+  /** Application-level entity / model name (custom: `app.entity`). */
+  readonly entity?: string | undefined
+  /** Sanitized / parameterized query text. Never include bound values. */
+  readonly query?: string | undefined
+  /** Optional fragments merged into final attributes (e.g. id, partition). */
+  readonly extra?: Record<string, unknown> | undefined
+}
+
+const dbAttributes = (a: DbSpanOptions): Record<string, unknown> => ({
+  "db.system.name": a.system,
+  "db.operation.name": a.operation,
+  "db.collection.name": a.collection,
+  ...(a.namespace !== undefined && { "db.namespace": a.namespace }),
+  ...(a.query !== undefined && { "db.query.text": a.query }),
+  ...(a.entity !== undefined && { "app.entity": a.entity }),
+  ...a.extra
+})
+
+/**
+ * Wrap an effect with an OTel-semconv database span.
+ *
+ * Span name follows the low-cardinality convention: `<operation> <collection>`.
+ */
+export const withDbSpan = (a: DbSpanOptions) =>
+  Effect.withSpan(
+    `${a.operation} ${a.collection}`,
+    { attributes: dbAttributes(a), kind: "client" as const },
+    { captureStackTrace: false }
+  )
+
+/**
+ * Annotate the current span with OTel-semconv database attributes.
+ *
+ * Use when the caller already owns the span (e.g. a repository) and the
+ * adapter should only contribute db.* semconv attrs without opening a child.
+ * Annotates before running so attrs persist even on failure.
+ * No-op if there is no current span.
+ */
+export const annotateDb = (a: DbSpanOptions) => <A, E, R>(self: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>
+  Effect.flatMap(Effect.annotateCurrentSpan(dbAttributes(a)), () => self)
+
+/** Annotate the current span with response metrics from a DB call. */
+export const annotateDbResponse = (m: {
+  readonly returnedRows?: number | undefined
+  readonly responseBytes?: number | undefined
+}) =>
+  Effect.annotateCurrentSpan({
+    ...(m.returnedRows !== undefined && { "db.response.returned_rows": m.returnedRows }),
+    ...(m.responseBytes !== undefined && { "db.response.body.size": m.responseBytes })
+  })
+
+/** Cosmos-specific response annotations. */
+export const annotateCosmosResponse = (m: {
+  readonly requestCharge?: number | undefined
+  readonly returnedRows?: number | undefined
+  readonly responseBytes?: number | undefined
+  readonly statusCode?: number | undefined
+}) =>
+  Effect.annotateCurrentSpan({
+    ...(m.requestCharge !== undefined && { "azure.cosmosdb.operation.request_charge": m.requestCharge }),
+    ...(m.statusCode !== undefined && { "db.response.status_code": String(m.statusCode) }),
+    ...(m.returnedRows !== undefined && { "db.response.returned_rows": m.returnedRows }),
+    ...(m.responseBytes !== undefined && { "db.response.body.size": m.responseBytes })
+  })
+
+export type MessagingSystem =
+  | "servicebus"
+  | "rabbitmq"
+  | "kafka"
+  | "memory"
+  | "sql"
+
+export type MessagingOperation =
+  | "publish"
+  | "create"
+  | "receive"
+  | "process"
+  | "settle"
+
+export interface MessagingSpanOptions {
+  readonly operation: MessagingOperation
+  readonly system: MessagingSystem
+  /** Queue / topic name. */
+  readonly destination: string
+  readonly messageId?: string | undefined
+  readonly conversationId?: string | undefined
+  readonly bodySize?: number | undefined
+  readonly extra?: Record<string, unknown> | undefined
+}
+
+const messagingAttributes = (a: MessagingSpanOptions): Record<string, unknown> => ({
+  "messaging.system": a.system,
+  "messaging.operation.name": a.operation,
+  "messaging.destination.name": a.destination,
+  ...(a.messageId !== undefined && { "messaging.message.id": a.messageId }),
+  ...(a.conversationId !== undefined && { "messaging.message.conversation_id": a.conversationId }),
+  ...(a.bodySize !== undefined && { "messaging.message.body.size": a.bodySize }),
+  ...a.extra
+})
+
+/** Wrap an effect with an OTel-semconv messaging span. */
+export const withMessagingSpan = (
+  a: MessagingSpanOptions,
+  kind: "producer" | "consumer"
+) =>
+  Effect.withSpan(
+    `${a.operation} ${a.destination}`,
+    { kind, attributes: messagingAttributes(a) },
+    { captureStackTrace: false }
+  )
+
+/** Build messaging span options without wrapping (for Effect.fn / setupRequestContextWithCustomSpan). */
+export const messagingSpanArgs = (
+  a: MessagingSpanOptions,
+  kind: "producer" | "consumer"
+) =>
+  ({
+    name: `${a.operation} ${a.destination}`,
+    kind,
+    attributes: messagingAttributes(a)
+  }) as const

package/src/rateLimit.ts

@@ -20,8 +20,13 @@
 //   }
 // }
 
-import { Array, type Duration, Effect, type NonEmptyArray } from "effect-app"
+import * as Array from "effect-app/Array"
+import type { NonEmptyArray } from "effect-app/Array"
+import * as Effect from "effect-app/Effect"
+import { dual } from "effect-app/Function"
+import type * as Duration from "effect/Duration"
 import type { Semaphore } from "effect/Semaphore"
+import type { Concurrency } from "effect/Types"
 
 /**
  * Executes the specified effect, acquiring the specified number of permits
@@ -45,36 +50,42 @@ export function SEM_withPermitsDuration(permits: number, duration: Duration.Dura
   }
 }
 
-export function batchPar<R, E, A, R2, E2, A2, T>(
-  n: number,
-  forEachItem: (item: T, iWithinBatch: number, batchI: number) => Effect.Effect<A, E, R>,
-  forEachBatch: (a: NonEmptyArray<A>, i: number) => Effect.Effect<A2, E2, R2>
-) {
-  return (items: Iterable<T>) =>
-    Effect.forEach(
-      Array.chunksOf(items, n),
-      (_, i) =>
-        Effect
-          .forEach(_, (_, j) => forEachItem(_, j, i), { concurrency: "inherit" })
-          .pipe(Effect.flatMap((_) => forEachBatch(_, i))),
-      { concurrency: "inherit" }
-    )
+export interface BatchOptions {
+  readonly concurrency?: Concurrency | undefined
 }
 
-export function batch<R, E, A, R2, E2, A2, T>(
-  n: number,
-  forEachItem: (item: T, iWithinBatch: number, batchI: number) => Effect.Effect<A, E, R>,
-  forEachBatch: (a: NonEmptyArray<A>, i: number) => Effect.Effect<A2, E2, R2>
-) {
-  return (items: Iterable<T>) =>
+export const batch: {
+  <T, A, E, R, A2, E2, R2>(
+    n: number,
+    forEachItem: (item: T, iWithinBatch: number, batchI: number) => Effect.Effect<A, E, R>,
+    forEachBatch: (a: NonEmptyArray<A>, i: number) => Effect.Effect<A2, E2, R2>,
+    options?: BatchOptions
+  ): (items: Iterable<T>) => Effect.Effect<Array<A2>, E | E2, R | R2>
+  <T, A, E, R, A2, E2, R2>(
+    items: Iterable<T>,
+    n: number,
+    forEachItem: (item: T, iWithinBatch: number, batchI: number) => Effect.Effect<A, E, R>,
+    forEachBatch: (a: NonEmptyArray<A>, i: number) => Effect.Effect<A2, E2, R2>,
+    options?: BatchOptions
+  ): Effect.Effect<Array<A2>, E | E2, R | R2>
+} = dual(
+  (args) => typeof args[0] !== "number",
+  <T, A, E, R, A2, E2, R2>(
+    items: Iterable<T>,
+    n: number,
+    forEachItem: (item: T, iWithinBatch: number, batchI: number) => Effect.Effect<A, E, R>,
+    forEachBatch: (a: NonEmptyArray<A>, i: number) => Effect.Effect<A2, E2, R2>,
+    options?: BatchOptions
+  ) =>
     Effect.forEach(
       Array.chunksOf(items, n),
       (_, i) =>
         Effect
           .forEach(_, (_, j) => forEachItem(_, j, i), { concurrency: "inherit" })
-          .pipe(Effect.flatMap((_) => forEachBatch(_, i)))
+          .pipe(Effect.flatMap((_) => forEachBatch(_, i))),
+      { concurrency: options?.concurrency }
     )
-}
+)
 
 // export function rateLimit(
 //   n: number,

package/src/test.ts

@@ -1,4 +1,4 @@
-import { S } from "effect-app"
+import * as S from "effect-app/Schema"
 import { copy } from "effect-app/utils"
 import { generate } from "./arbs.js"
 
@@ -16,7 +16,7 @@ export const createRandomInstance = <A extends object, I, R>(s: S.Codec<A, I, R>
 /**
  * Like `createRandomInstance`, but takes encoded values rather than decoded ones.
  */
-export const createRandomInstanceI = <A extends object, I>(s: S.Codec<A, I, never> & { fields: S.Struct.Fields }) => {
+export const createRandomInstanceI = <A extends object, I>(s: S.Codec<A, I> & { fields: S.Struct.Fields }) => {
   const gen = generate(S.toArbitrary(s))
   const encode = S.encodeSync(s)
   const decode = S.decodeSync(s)

package/test/auth.test.ts

@@ -0,0 +1,101 @@
+import { describe, expect, it } from "@effect/vitest"
+import * as Effect from "effect-app/Effect"
+import { HttpHeaders } from "effect-app/http"
+import { SignJWT } from "jose"
+import { checkJWTI, InvalidRequestError, InvalidTokenError, UnauthorizedError } from "../src/api/internal/auth.js"
+
+const issuer = "https://issuer.example.com/"
+const audience = "effect-app"
+const secret = "test-secret-test-secret-test-secret"
+
+const makeToken = () =>
+  new SignJWT({ scope: "read:all" })
+    .setProtectedHeader({ alg: "HS256", typ: "at+jwt" })
+    .setIssuer(issuer)
+    .setAudience(audience)
+    .setIssuedAt()
+    .setExpirationTime("10m")
+    .sign(new TextEncoder().encode(secret))
+
+describe("checkJWTI", () => {
+  it.effect(
+    "validates a bearer token from headers",
+    Effect.fnUntraced(function*() {
+      const token = yield* Effect.promise(() => makeToken())
+
+      yield* checkJWTI({
+        audience,
+        issuer,
+        secret,
+        strict: true,
+        tokenSigningAlg: "HS256"
+      })(HttpHeaders.fromRecordUnsafe({ authorization: `Bearer ${token}` }))
+    })
+  )
+
+  it.effect(
+    "fails on malformed authorization headers",
+    Effect.fnUntraced(function*() {
+      const error = yield* Effect.flip(
+        checkJWTI({
+          audience,
+          issuer,
+          secret,
+          tokenSigningAlg: "HS256"
+        })(HttpHeaders.fromRecordUnsafe({ authorization: "Basic abc" }))
+      )
+
+      expect(error).toBeInstanceOf(InvalidRequestError)
+      expect(error.status).toBe(400)
+    })
+  )
+
+  it.effect(
+    "fails when the token is missing",
+    Effect.fnUntraced(function*() {
+      const error = yield* Effect.flip(
+        checkJWTI({
+          audience,
+          issuer,
+          secret,
+          tokenSigningAlg: "HS256"
+        })(HttpHeaders.empty)
+      )
+
+      expect(error).toBeInstanceOf(UnauthorizedError)
+      expect(error.status).toBe(401)
+    })
+  )
+
+  it.effect(
+    "allows missing tokens when auth is optional",
+    Effect.fnUntraced(function*() {
+      yield* checkJWTI({
+        audience,
+        authRequired: false,
+        issuer,
+        secret,
+        tokenSigningAlg: "HS256"
+      })(HttpHeaders.empty)
+    })
+  )
+
+  it.effect(
+    "fails when the token signature is invalid",
+    Effect.fnUntraced(function*() {
+      const token = yield* Effect.promise(() => makeToken())
+
+      const error = yield* Effect.flip(
+        checkJWTI({
+          audience,
+          issuer,
+          secret: "wrong-secret-wrong-secret-wrong-secret",
+          tokenSigningAlg: "HS256"
+        })(HttpHeaders.fromRecordUnsafe({ authorization: `Bearer ${token}` }))
+      )
+
+      expect(error).toBeInstanceOf(InvalidTokenError)
+      expect(error.status).toBe(401)
+    })
+  )
+})